CVE-2023-23626

go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s. This happen when the `size` is a not a multiple of `8` or is negative. There were already a note in the `NewBitfield` documentation, however known users of this package are subject to this issue. Users are advised to upgrade. Users unable to upgrade should ensure that `size` is a multiple of 8 before calling `NewBitfield` or `FromBytes`.

• CWE-754
• CWE-1284

• https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579Patch
• https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9rExploit, Patch, Vendor Advisory
• https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579Patch
• https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9rExploit, Patch, Vendor Advisory

Published

Feb 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23620Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2023-23621Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2023-23622Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2023-23623Electron is a framework which lets you write cross-platform …9.8
• CVE-2023-23624Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2023-23625go-unixfs is an implementation of a unix-like filesystem on …7.5
• CVE-2023-23627Sanitize is an allowlist-based HTML and CSS sanitizer. Versi…6.1
• CVE-2023-23628Metabase is an open source data analytics platform. Affected…4.1
• CVE-2023-23629Metabase is an open source data analytics platform. Affected…6.3
• CVE-2023-2363A vulnerability, which was classified as critical, has been …9.8
• CVE-2023-23630Eta is an embedded JS templating engine that works inside No…6.1
• CVE-2023-23631github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that…7.5